10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Defining Security Requirements forWeb Applications<br />

858<br />

FIGURE 30–3 Form-Based Authentication<br />

Client<br />

1<br />

Requests protected resource<br />

2<br />

login.jsp<br />

Redirected to<br />

login page<br />

3<br />

Form submitted<br />

4<br />

Redirected to source<br />

error.jsp<br />

Error page returned<br />

<strong>The</strong> following example shows how to declare form-based authentication in your deployment<br />

descriptor:<br />

<br />

FORM<br />

file<br />

<br />

/logon.jsp<br />

/logonError.jsp<br />

<br />

<br />

Server<br />

j_security_check<br />

Success<br />

?<br />

Failure<br />

<strong>The</strong> login and error page locations are specified relative to the location of the deployment<br />

descriptor. Examples of login and error pages are shown in “Creating the Login Form and the<br />

Error Page” on page 865.<br />

Form-based authentication is not particularly secure. In form-based authentication, the content<br />

of the user dialog box is sent as plain text, and the target server is not authenticated. This form<br />

of authentication can expose your user names and passwords unless all connections are over<br />

SSL. If someone can intercept the transmission, the user name and password information can<br />

easily be decoded. However, when a secure transport mechanism, such as SSL, or security at the<br />

network level, such as the IPSEC protocol or VPN strategies, is used in conjunction with<br />

form-based authentication, some of these concerns can be alleviated.<br />

<strong>The</strong> section “Example: Using Form-Based Authentication with a JSP Page” on page 863 is an<br />

example application that uses form-based authentication.<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!